Kiran 
A previously unseen Android banking trojan called StreamRat, distributed through Meta and TikTok ads that pose as a free TV-streaming service.
The campaign, dubbed “Steamtv Esp,” targeted Spanish-speaking users and reached an estimated 570,000 potential victims through Facebook and Instagram ads between June 11 and July 3, 2026.
ThreatFabric spotted the campaign while tracking IPTV-themed lures it had documented in earlier reports. The threat actor behind Steamtv Esp built a phishing site that mimicked a streaming app and promoted it via paid social ads. Clicking through led victims to a payload hosted on a GitHub account previously linked to the Mirax banking trojan.
StreamRat Android Trojan Uses Meta and TikTok Ads
While the dropper closely resembled the one used for Mirax, the final payload was entirely new: StreamRat. Researchers note the same operator has now cycled through three distinct financial malware families: GodFather, Mirax, and StreamRat, suggesting a well-resourced group with access to multiple malware-as-a-service (MaaS) offerings.
The infection chain is deliberately layered. The phishing site first checks the visitor’s operating system via JavaScript, hiding the download button entirely for non-Android users.
Android visitors are redirected to a page named “r1edmi.html,” which detects whether the victim arrived via Instagram, TikTok, Facebook, or a browser, then tailors step-by-step install instructions accordingly while silently pinging the attacker’s Telegram bot with a notification.
Once installed, the dropper’s HTML-based interface tries to set itself as the device’s default launcher, hijacking the Home button to keep victims trapped in the install flow.
It then quietly requests VPN permissions to establish a non-functional VPN tunnel that blocks all outbound internet traffic except its own a technique ThreatFabric says is designed to blind cloud-based scanners like Google Play Protect during the critical install window, without fully defeating its offline detection.
Once StreamRat gains access to the Accessibility Service, it connects to a hardcoded C2 server over a custom WebSocket-based RPC protocol using device-fingerprint headers.
From there, operators can deploy phishing overlays, log keystrokes, harvest the full app inventory in chunks, and stream the victim’s screen live either via MediaProjection-based VNC or a stealthier Accessibility-driven HVNC mode that is invisible to the user.
Both modes use Adler-32 checksum deduplication and aggressive WebP compression to cut bandwidth, a level of engineering polish researchers describe as unusual for a first-generation trojan.
“What stands out with StreamRat isn’t a single flashy feature; it’s the coherence of the engineering,” a ThreatFabric analyst noted. “Deduplication logic, chunked data exfiltration, a role-based MaaS panel these are the fingerprints of developers building infrastructure for resale, not a one-off scam.”
ThreatFabric’s analysis of the leaked control panel code reveals a full MaaS backend: device dashboards showing battery level, region, and intercepted PINs; injection and overlay management; a payload/dropper builder; and tiered user roles (user, supervisor, admin) architecture clearly designed for renting access to multiple criminal customers.
Any Android app requesting both installation-from-unknown-sources and VPN permissions together should raise immediate suspicion. Sudden loss of internet connectivity during an app install, unsolicited streaming app ads on social media, and requests to enable Accessibility Services for a “TV” app are all red flags directly tied to this campaign.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
